NPM: Nx: Path traversal in nx migrate package-migrations extraction

NPM: Nx: Path traversal in nx migrate package-migrations extraction vulnerability discovered by ? in WordPress Npm nx versions = 13.10.0, 22.7.10...

Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

EUVD-2026-91761

Nx: Path traversal in nx migrate package-migrations extraction...

GHSA-HRVQ-X7JP-36XV Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

NPM: vm2: NodeVM custom resolution bypasses external path boundaries

NPM: vm2: NodeVM custom resolution bypasses external path boundaries vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

GHSA-5H3F-Q97H-CCVC vm2: NodeVM custom resolution bypasses external path boundaries

Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...

vm2: NodeVM custom resolution bypasses external path boundaries

Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...

CVE-2023-1177

CVE-2023-1177 | | MLFlow Pfad-Traversal | Getestet auf MLflow 2.2.0 | Quelle: https://github.com/iumiro/CVE-2023-1177-MLFlow | .. code-block:: bash !/bin/bash RAND="EXPLOIT-$1+$RANDOM%9999" URL="http://172.17.0.2:6001" FILE='/root/.ssh/idrsa' curl -vX POST...

CVE-2024-23774

CVE-2024-23774 - Sicherheitslücke durch nicht in Anführungszeichen gesetzten Windows-Dienstpfad Informationen folgen zu gegebener Zeit...

CVE-2019-17234b-Exploit

Wordpress IgniteUp Plugin-Sicherheitslücke Das Wordpress IgniteUp Plugin v3.4 und darunter erlaubt entfernten, nicht authentifizierten Benutzern, potenziell beliebige Dateien auf dem Ziel-Webserver zu löschen, was möglicherweise einen Denial-of-Service-Angriff verursacht. CVE-2019-17234 Zeitleist...

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

GHSA-7G7C-H8RR-7P6Q Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...

CVE-2026-105751

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-77262

CVE-2026-77262 — Beliebiger Dateizugriff Arbitrary File Read in mcp-atlassian über confluenceuploadattachment Schweregrad : Hoch CVSS 8.6 CWE : CWE-22 — Path Traversal Betroffen : sooperset/mcp-atlassian 0.22.0 Behoben in : 0.22.0 Advisory : GHSA-p6hp-93wp-fh6p NVD :...

CVE-2026-28995

CVE-2026-28995 Proof of Concept per CVE-2026-28995 — Vulnerabilità di Path Traversal in App Intents su iOS 26.4.2 e versioni precedenti. Descrizione Questa vulnerabilità permette a un'app dannosa di leggere qualsiasi file al di fuori della sua sandbox tramite App Intents. La causa principale è un...

CVE-2026-105751 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

EUVD-2026-92815

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105748

The Docling library (versions 2.16.0 through 2.131.0 ) is vulnerable because the InputFormat.JSON_DOCLING backend fails to reject picture image references containing local paths or file URIs during serialized DoclingDocument input validation. When processing with ImageRefMode.EMBEDDED , the Docli...

CVE-2026-105748 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...